Privacy Policy

Fatouraty ("we", "us") provides accounting and e-invoicing software for businesses in the MENA region. This policy explains what personal and financial data we process, why, and the rights you have over it. It applies to our website, web app, and mobile app.

Account data: your email address and name, used to sign you in (passwordless) and identify you.

Business & financial data you enter: workspaces, contacts, invoices, bills, payments, chart of accounts, tax registration numbers, and the ledger derived from them.

Technical data: minimal server logs and the source IP used for security (e.g. the admin IP allowlist). We do not use third-party advertising or analytics trackers.

Encryption in transit: all traffic is HTTPS with HSTS enforced.

Encryption at rest: sensitive fields are encrypted with envelope encryption (AES-256) using a per-workspace data key. Deleting a workspace destroys its key — a crypto-shred that renders the data unrecoverable.

Tamper-evident ledger: posted journal entries are immutable and append-only at the database level; corrections are made through reversing entries, preserving a full audit trail.

Access control: strict tenant isolation on every record, role-based permissions, and optional two-factor authentication for every user.

Your data is hosted on managed infrastructure (Netlify and Railway). Payment processing is handled by our payment providers (Stripe and Tap Payments) — we never store full card numbers. Email delivery uses Resend. These providers act as our processors under contract.

If you buy a local-ownership licence, you run Fatouraty entirely on your own device and your data never leaves it.

You can export a complete copy of your data at any time from Settings → Your data, and permanently delete your account there too. You may also access, correct, or restrict processing of your personal data. We honour the rights granted under Saudi Arabia's PDPL and the EU GDPR where applicable.

We keep your data for as long as your account is active. When you delete your account, workspaces you solely own are erased immediately (crypto-shredded). Note that tax and accounting law in your country may require you to retain your own records for a number of years — exporting before deletion is recommended.

We use strictly necessary cookies only: a secure, httpOnly session cookie to keep you signed in, a second-factor cookie when 2FA is enabled, and a cookie remembering your language. We do not use advertising or cross-site tracking cookies.

Fatouraty is a business product and is not directed to anyone under 18.

We may update this policy; material changes will be announced in-app. For any privacy request or question, contact us by email and we will respond within a reasonable time.